Context Poisoning via Compaction Survival
AI coding agents like Claude Code periodically compress or summarize their conversation history to save space, a process called compaction. Attackers hide instructions in project files such as SKILL.md or CLAUDE.md that are written to look critically important, so the agent preserves them intact through this compression instead of letting them fade with the rest of the discarded context.
How the attack works
An attacker plants a SKILL.md or CLAUDE.md file in a repository or shared project that an AI agent will read. The file contains instructions phrased with urgency markers, persistence directives, and language impersonating system-level authority, designed to be flagged as 'important' by the summarization process. When the agent's context window fills up and gets compacted, these instructions survive while ordinary conversation content is dropped. The planted instructions then keep influencing the agent's behavior long after the original file was read, effectively giving the attacker a foothold that outlasts normal context turnover.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 88e23f46-cc91-415e-a215-635e45acf238
- Severity
- High
Why it matters
An organization loses control over what its AI agent will do in later stages of a long session, since attacker instructions can persist invisibly across memory compression and keep steering the agent toward unauthorized actions.
What you can do
- →Review SKILL.md, CLAUDE.md, and similar agent-configuration files in any repository before letting an agent load them, treating them as untrusted input.
- →Watch for instruction text using urgency language, persistence directives, or claims of system-level authority inside these configuration files.
- →After context compaction, audit what instructions or directives the agent retained and confirm they trace back to legitimate, reviewed sources.
- →Restrict which files an agent is allowed to treat as configuration or 'skill' definitions, rather than accepting any file with that name from a repository.
Known benign look-alikes
- Documentation or research papers discussing context window management strategies that use phrases like 'maintain these settings across context windows' when describing legitimate agent configuration best practices rather than attacks.